Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/11/2026, 02:42
General
- Target 2026-11-12_56de36e303bf8987891864384ec0000b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261113-c7debaez3y
- SHA256 cf39678ee8b06836380596d158acb344e0e3daf44bec1c7a9d915ba2de3f77f7
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-12_56de36e303bf8987891864384ec0000b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-12_56de36e303bf8987891864384ec0000b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\wqojgbywqoigebzt.exeC:\Temp\wqojgbywqoigebzt.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywtolgbyt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\eywtolgbyt.exeC:\Temp\eywtolgbyt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywtolgbyt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eywtolgbyt.exeC:\Temp\i_eywtolgbyt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigaytqlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigaytqlj.exeC:\Temp\qoigaytqlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigaytqlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigaytqlj.exeC:\Temp\i_qoigaytqlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqnifays.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\aysqnifays.exeC:\Temp\aysqnifays.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqnifays.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_aysqnifays.exeC:\Temp\i_aysqnifays.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axspkicaus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\axspkicaus.exeC:\Temp\axspkicaus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axspkicaus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_axspkicaus.exeC:\Temp\i_axspkicaus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxspkhcau.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fzxspkhcau.exeC:\Temp\fzxspkhcau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxspkhcau.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxspkhcau.exeC:\Temp\i_fzxspkhcau.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpjhczus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhczus.exeC:\Temp\zxrpjhczus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpjhczus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpjhczus.exeC:\Temp\i_zxrpjhczus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wurmkecwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wurmkecwuo.exeC:\Temp\wurmkecwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wurmkecwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wurmkecwuo.exeC:\Temp\i_wurmkecwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwrojhbztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zwrojhbztr.exeC:\Temp\zwrojhbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwrojhbztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zwrojhbztr.exeC:\Temp\i_zwrojhbztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqojgeywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywqojgeywq.exeC:\Temp\ywqojgeywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqojgeywq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywqojgeywq.exeC:\Temp\i_ywqojgeywq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdbvtnlgd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgdbvtnlgd.exeC:\Temp\lgdbvtnlgd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdbvtnlgd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgdbvtnlgd.exeC:\Temp\i_lgdbvtnlgd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnlfdyvqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qnlfdyvqoi.exeC:\Temp\qnlfdyvqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnlfdyvqoi.exe ups_ins3⤵
-
C:\Temp\i_qnlfdyvqoi.exeC:\Temp\i_qnlfdyvqoi.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicayvpnki.exe ups_run3⤵
-
C:\Temp\kicayvpnki.exeC:\Temp\kicayvpnki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicayvpnki.exe ups_ins3⤵
-
C:\Temp\i_kicayvpnki.exeC:\Temp\i_kicayvpnki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnkfdxspni.exe ups_run3⤵
-
C:\Temp\pnkfdxspni.exeC:\Temp\pnkfdxspni.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnkfdxspni.exe ups_ins3⤵
-
C:\Temp\i_pnkfdxspni.exeC:\Temp\i_pnkfdxspni.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khfcauspnh.exe ups_run3⤵
-
C:\Temp\khfcauspnh.exeC:\Temp\khfcauspnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khfcauspnh.exe ups_ins3⤵
-
C:\Temp\i_khfcauspnh.exeC:\Temp\i_khfcauspnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkecwupmh.exe ups_run3⤵
-
C:\Temp\smkecwupmh.exeC:\Temp\smkecwupmh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkecwupmh.exe ups_ins3⤵
-
C:\Temp\i_smkecwupmh.exeC:\Temp\i_smkecwupmh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljebwuomg.exe ups_run3⤵
-
C:\Temp\rljebwuomg.exeC:\Temp\rljebwuomg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljebwuomg.exe ups_ins3⤵
-
C:\Temp\i_rljebwuomg.exeC:\Temp\i_rljebwuomg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urmjdbzwuo.exe ups_run3⤵
-
C:\Temp\urmjdbzwuo.exeC:\Temp\urmjdbzwuo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urmjdbzwuo.exe ups_ins3⤵
-
C:\Temp\i_urmjdbzwuo.exeC:\Temp\i_urmjdbzwuo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtolgeywqo.exe ups_run3⤵
-
C:\Temp\wtolgeywqo.exeC:\Temp\wtolgeywqo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtolgeywqo.exe ups_ins3⤵
-
C:\Temp\i_wtolgeywqo.exeC:\Temp\i_wtolgeywqo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqnljdbvtn.exe ups_run3⤵
-
C:\Temp\vqnljdbvtn.exeC:\Temp\vqnljdbvtn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqnljdbvtn.exe ups_ins3⤵
-
C:\Temp\i_vqnljdbvtn.exeC:\Temp\i_vqnljdbvtn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvtnlfdxvq.exe ups_run3⤵
-
C:\Temp\xvtnlfdxvq.exeC:\Temp\xvtnlfdxvq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x304,0x7ffa14bdc188,0x7ffa14bdc194,0x7ffa14bdc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1804,i,5190339665570934685,1068386091534220345,262144 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,14241924735537574563,9170769498701770738,524288 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,16888735527187511054,16093603273931563140,524288 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,11565158084274983918,13958074960946674599,2097152 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,9425686217581637695,12413622785230497607,2097152 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,12091744153786040934,10980269290645314424,2097152 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,15384395161979518305,3471884256775886924,2097152 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,6279311360987614246,13445384362358536255,524288 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,5282148125073927760,11876532647961507711,524288 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,12342155982516463373,11958092939413553524,524288 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,9851143433507054769,4658670042476149437,524288 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,9851143433507054769,4658670042476149437,524288 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,18168913198476806849,1594370899434225181,524288 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,1673781700904412282,8438123675544356823,524288 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,17627541070199965987,13280743509310255633,524288 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,9194348300906346254,7479291702122244186,524288 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,18444270986069937091,14770664019560789736,524288 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,9938979849357284284,3131441867764173297,524288 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,6428352518565076342,1682026290695291515,524288 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,15116998480159682414,5324830071900394501,524288 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,1725239263100882359,6806482000036701700,524288 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,1324763745062802829,11482185860629736294,524288 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,5300914013254619681,4558521880279442809,524288 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=944 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6880,i,3684096197699311806,16755640834641681315,262144 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,12767527028031053135,17055809018604270085,524288 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,6982593457182971229,15579856989226125753,524288 --field-trial-handle=3012,i,9818381140304093853,2168151535168137703,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\wqojgbywqoigebzt.sysC:\Temp\wqojgbywqoigebzt.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\vtqljdbvtn.sysC:\Temp\vtqljdbvtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdaysqlida.sysC:\Temp\fdaysqlida.sys1⤵
- Executes dropped EXE
-
C:\Temp\idavsnlfdx.sysC:\Temp\idavsnlfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\fcausnkfca.sysC:\Temp\fcausnkfca.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpmkecaus.sysC:\Temp\xrpmkecaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhcztr.sysC:\Temp\zxrpjhcztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\hezwromjhb.sysC:\Temp\hezwromjhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbwtomgey.sysC:\Temp\jdbwtomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqoigdbytq.sysC:\Temp\wqoigdbytq.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlfdxvqnig.sysC:\Temp\nlfdxvqnig.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqkigaysq.sysC:\Temp\ysqkigaysq.sys1⤵
-
C:\Temp\vsnlfdxvpn.sysC:\Temp\vsnlfdxvpn.sys1⤵
-
C:\Temp\pmkfcxusmk.sysC:\Temp\pmkfcxusmk.sys1⤵
-
C:\Temp\mjhczwupjh.sysC:\Temp\mjhczwupjh.sys1⤵
-
C:\Temp\zwrpmhezxr.sysC:\Temp\zwrpmhezxr.sys1⤵
-
C:\Temp\trojheywuo.sysC:\Temp\trojheywuo.sys1⤵
-
C:\Temp\ztrljdbwto.sysC:\Temp\ztrljdbwto.sys1⤵
-
C:\Temp\ytqlidbvtn.sysC:\Temp\ytqlidbvtn.sys1⤵
-
C:\Temp\gaysqnlida.sysC:\Temp\gaysqnlida.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
axspkicaus.exe
aysqnifays.exe
eywtolgbyt.exe
fcausnkfca.sys
fdaysqlida.sys
fzxspkhcau.exe
i_axspkicaus.exe
i_aysqnifays.exe
i_eywtolgbyt.exe
i_fzxspkhcau.exe
i_qoigaytqlj.exe
idavsnlfdx.sys
qoigaytqlj.exe
vtqljdbvtn.sys
wqojgbywqoigebzt.exe
wqojgbywqoigebzt.sys
xrpmkecaus.sys
zxrpjhczus.exe
03e42b1b-8b98-467d-bcc0-60a25ad03958.tmp
201c88a7-0bf8-4617-b025-16ea4550c4e6.tmp
2404792b-04c2-447f-8eab-a74ecc035768.tmp
4d8830c9-107d-48ad-81d1-485755b84f06.tmp
8c75378b-1d90-482b-8e7c-f2d26c68d6bd.tmp
986d7fc6-f8f8-4535-b34a-66d1dcded078.tmp
1b62b696-7581-4a14-a88b-6529b09a25a8.tmp
manifest.json
settings.dat
settings.dat
1b08ac40-1bec-4811-93d7-18af1da43e94.tmp
3d912978-a466-45af-8d58-a43000a05c7b.tmp
54ec9794-e3de-4ce0-b61f-d4ce6d8eee4a.tmp
87ba07d5-9b6f-4fa6-b786-2a511f77cfbd.tmp
temp-index
the-real-index
38bcf465-6a89-45b8-a16d-039a3e58cb14.tmp
dasherSettingSchema.json
0d5c261a-a2a0-4c4a-85c3-2eaf7c65bf5d.tmp
6359c5bc-e4e6-492b-a364-1c787808c9ae.tmp
c7832c29-a7e9-4045-b024-fbb64c1eb4e4.tmp
Preferences
sync_diagnostic.log
ab6c74a0-09ab-480f-87c1-0923500f50c8.tmp
867a1732-4441-47b1-af78-31e96fa75f81.tmp
OperationConfig
manifest.json
manifest.json
manifest.json
1f3f7e8e-2486-4cb3-af8d-aca15fa36f07.tmp
5805ee2f-de7b-4392-8eb2-e0af8b4e7384.tmp
7f48c0f8-4af8-4257-b2b4-fb616322b7c2.tmp
99b28f8b-71d3-4df7-9edb-d1e53a1a19e2.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
7e705f22-dc5f-45d1-838b-05e52941f046.tmp
bad9fb93-7184-41ca-b8c0-d8240bb1d475.tmp
894415b1-740d-4f56-a24f-f082d43e0d31.tmp
75c76b3a-d463-43ca-a040-96d17fed06bd.tmp
content.js
messages.json
protocols.json
llm_user_input_extractor_config.json
office_endpoints_list.json
smart_switch_list.json
LICENSE
verified_contents.json
keys.json
manifest.json
nav_config.json
CreateProcess.exe
memory/908-692-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1652-489-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1752-438-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1808-759-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1868-64-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2448-542-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2564-620-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2760-713-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3232-688-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3232-657-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3472-786-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3608-585-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3920-569-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4100-565-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4132-651-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4132-589-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4600-517-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4700-710-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4924-529-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4992-473-0x000002860A4E0000-0x000002860A721000-memory.dmp
memory/5684-765-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6088-741-0x0000000000010000-0x00000000000AB000-memory.dmp